Re: Cannot perform signing when multiple keys are present
Douglas E Engert <[email protected]>
| Newsgroups | gmane.comp.encryption.opensc.devel |
|---|---|
| Message-ID | <[email protected]> |
On 12/19/2016 8:45 AM, Marcin Okraszewski wrote: > Hi Douglas, > Thank you for explanation. So, what I understand here, if only there is connection to the reader, I should be able to use the token from OpenSSL via libp11. I believe I understand your comment, If only one PIV like card is present. > The token is visible, as I'm able to > initialize it, generate key, import certificate via Yubico's piv-tool. Yes, these use PCSC but not any PKCS#11. > But I'm not able even to list tokens with p11tool. Note, I don't specify any configuration. I just install OpenSC and run > "gnutls-3.4.9\bin\p11tool.exe --provider c:\Windows\System32\opensc-pkcs11.dll --list-tokens". I run it as administrator. I can not speak to how p11tool should work. Is there some 32 bit opensc-pkcs11.dll with 64 bit p11tool? You are running in a cmd window? What does the OpenSC pkcs11-tool.exe -O -l show? Do you get any output? > > When it comes to Device Manager, the card is not being recognized even if I regenerate CHUID, unplug and plug token again or even reboot Windows (2012 R2). The CHUID is being set and I can see the > value being changed by status action. When you regenerated the CHUID, did it tell you what it did? There was a bug in in how Yubico created a CHUID It was fixed in 2014. Are you using an old version? https://github.com/Yubico/yubico-piv-tool/issues/9 I believe there is a verbose option for yubico-piv-tool to list the chuid, or list it while it is created. Also see: https://github.com/OpenSC/OpenSC/wiki/Using-OpenSC on how to setup a opensc debug log and an opensc SPY log. These would show what might be going on. It would also show if the CHUID was being read, and it binary value. > > Thanks, > Marcin > > On Fri, Dec 16, 2016 at 5:19 PM, Douglas E Engert <[email protected] <mailto:[email protected]>> wrote: > > > > On 12/16/2016 8:54 AM, Marcin Okraszewski wrote: > > I think I have the root cause, which lies completely elsewhere. Apparently Yubikey driver doesn't install properly on this machine. Normally you Yubikey is visible in Device Manager under > Smart cards > section as "Identity Device (NIST SP 800-73 [PIV])". > On that machine I see "Unknown Smart Card" (see attached screenshots). I don't know yet why is it so, but this is out of scope for this group I > guess. > > > Microsoft has its own PIV smart card driver used with its CAPI and minidrivers. > Google for: microsoft PIV and for:microsoft minidriver > > So for PIV cards at least, unless you need PKCS#11 you don't need third party software. > What I think you are seeing in device manager is the fact the Microsoft recognizes its a PIV card. > But the Microsoft code requires a CHUID on the card to recognize it as a PIV. The NIST 800-73 says the CHUID is a mandatory. > Yubico may or may not provide their own driver, but as I understand it, the reason for Yubico to present a PIV > interface is to not require additional software. > > OpenSC and other vendors provide software that interfaces with smart cards at the PCSC level just like on the Linux. > so all that is needed is access the readers. > OpenSC and other vendors also provides a minidriver that can access any smartcard OpenSC supports, so one can get > CAPI access to card. But this also requires registry changes to list the ATRs of the cards supported. > > > Sorry, I was so mislead with the fact there are two tokens and that other tools does see Yubikey that I didn't even thought of checking it. Only the empty list from p11tool and together with > Douglas pointing other tools are not use PKCS#11 module triggered finally the thought check it. > > For completeness, here is the debug output from p11tool: > > \gnutls-3.4.9\bin\p11tool.exe --provider c:\Windows\System32\opensc-pkcs11.dll --list-tokens > > (p11-kit:2992) p11_library_init: initializing library > (p11-kit:2992) p11_kit_module_load: in: c:\Windows\System32\opensc-pkcs11.dll > (p11-kit:2992) load_module_from_file_inlock: loading module from path: c:\Windows\System32\opensc-pkcs11.dll > (p11-kit:2992) dlopen_and_get_function_list: opened module: c:\Windows\System32\opensc-pkcs11.dll > (p11-kit:2992) p11_kit_module_load: out: success > (p11-kit:2992) p11_kit_module_release: in > (p11-kit:2992) p11_kit_module_release: out > (p11-kit:2992) uninit_common: uninitializing library > > Thank you, > Marcin Okraszewski > > > On Thu, Dec 15, 2016 at 9:08 PM, David Woodhouse <[email protected] <mailto:[email protected]> <mailto:[email protected] <mailto:[email protected]>>> wrote: > > On Thu, 2016-12-15 at 19:18 +0100, Marcin Okraszewski wrote: > > > > It provides no output, there. So, it looks like the p11 doesn't see > > the token at all (while other tools does). Removing the other token > > doesn't help too. > > Sounds like your PKCS#11 provider module is installed without a > corresponding p11-kit .module file to let applications know where to > find it automatically. > > That is unfortunately the case even on poorly-maintained Linux > distributions; it's not surprising that it's the case on Windows. > You'll probably have to make the .module file manually. > > https://p11-glue.freedesktop.org/doc/p11-kit/pkcs11-conf.html <https://p11-glue.freedesktop.org/doc/p11-kit/pkcs11-conf.html> <https://p11-glue.freedesktop.org/doc/p11-kit/pkcs11-conf.html > <https://p11-glue.freedesktop.org/doc/p11-kit/pkcs11-conf.html>> > -- > dwmw2 > > > > -- > > Douglas E. Engert <[email protected] <mailto:[email protected]>> > > -- Douglas E. Engert <[email protected]> ------------------------------------------------------------------------------ Developer Access Program for Intel Xeon Phi Processors Access to Intel Xeon Phi processor-based developer platforms. With one year of Intel Parallel Studio XE. Training and support from Colfax. Order your platform today.http://sdm.link/intel